Spy radio
Burst encoders
• • • Donate • • •
   Click for homepage
Racal MA-4777   Cougar
Voice encryption unit

The MA-4777 was a voice encryption/decryption unit, developed by Racal Ltd in Bracknell (UK) in 1987. It was intended for use in combination with Racal Cougar radio sets, but was also used with other transceivers, such as the Belgian VRC-8000. The MA-4777 was produced until 2001.

The image on the right shows a typical MA-4777C. The device is housed in a ruggedized green metal enclosure. At the front is the connection for the handset. In the MA-4777C this is a 6-pin U-229 socket for connection of a standard US or NATO handset or headset.

On the MA-4777A, a military 7-pin 105 socket, similar to the one at the rear panel, is present at this location. It is for connection to Clansman equipment. The connector at the rear is for connecting the MA-4777 to a transceiver, using an adapter cable that is suitable for the radio.

The only controls that are available on the MA-4777 are the two rotary selectors on the front panel. The upper one is for setting the audio volume, whilst the lower one is used to select one of four key compartments, marked A, B, C and D. Clear speech is selected by setting the lower switch to the Clr-position. Setting both switches to Z, purges or zeroizes the keys instantly.

Production of the MA-4777 started around 1987 with the MA-4777C. Over the years, the design was improved and simplified several times, but the Crypto Module remained the same. The latest version is the MA-4777A, which was produced from 1994 until the end of its life cycle in 2011.

MA-4777C MA-4777C Small portable unit Front panel Rear panel U-229 socket for connection of a handset Socket for connection of the transceiver Mode switches
Model suffix
Typically, a single letter suffix (A, B or C) is used to designate the three different MA-4777 versions. In some cases, a second suffix letter is present to indicate the type of crypto module that is fitted. At present, the following suffixes are known:

Key loading
When the Racal proprietary MX-4437 crypto module is fitted, four modes of secure operation are provided. The keys for these modes have to be loaded into the MA-4777 by means of the battery powered MA-4073 programmer, that is connected to the audio socket at the front panel.

Alternatively, the smaller MA-4083 fill gun can be used. It is powered by the MA-4777 and must first be loaded from an MA-4073 programmer.

The image on the right shows an MA-4073 programmer and an MA-4083 fill gun side-by-side. Note that these devices were also used for other radio types (and for setting frequencies).

 About the MA-4073 programmer
 About the MA-4083 fill gun
MA-4073 programmer and MA-4083 fill gun

When the Special Crypto Module is installed, two modes of secure operation are provided. The keys for these modes are loaded with a special fill unit and the Optical Fill Interface MA-4549A.

The image on the right shows such an optical fill interface. It is powered from the device to which it is connected. Once the interface is connected to the MA-4777, the special fill unit is placed in the cradle, with its 'eye' towards the rear. To date we have not seen the required fill device for this method of key loading

If the MA-4777 was issued with the MA-4487 Crypto Module, that features the SAVILLE algorithm, a DS-102 compatible key loader had to be used. However, as the fill interface of the MA-4777 is not compatible with DS-102, the special MA-4778 interface was developed.

The image on the right shows the MA-4778, which has a fixed cable for connection to the MA-4777 or a compatible radio. The MA-4778 itself has to be filled from a DS102 compatible key loader first, such as the KYK-13.

 About the MA-4778 interface (DS-102)
Racal MA-4778 key loader with DS-102 protocol

In order to allow secure communication with other MA-4777 units, or with a radio that has a built-in compatible crypto unit (e.g. PRM-4515 Cougar), the following conditions must be met: All units must be fitted with the same crypto module, the must all have the same crypto variables (keys) loaded, and the same key compartment (A, B, C or D) must be selected on all devices.

The cryptographic keys are stored inside the MA-4777 in a volatile static memory (RAM) that is retained by a Lithium backup battery.

In case security is comprimised, the crypto keys can be deleted instantly, by turning and holding both rotary switched fully counter-clockwise to the Z-position. For this you need both hands as the switches are momentary.
Mode switches

The MA-4777 is housed in a sturdy slim-line metal enclosure with separate front panel and rear panel assemblies that are watertight. It can be opened by removing the outmost two bolt from the rear panel, after which the rear panel can be separated and disconnected from the rest.

Once this is done, the complete interior can be removed by pulling the front panel away from the case. Inside the MA-4777 are two printed circuit boards (PCBs) that are mounted to a die-cast aluminium frame that in turn is attached to the front panel.

The two PCBs are mounted opposite of each other, with a large 34-pin header connecting them. One PCB hold the control circuits whilst the other one is the Crypto PCB. The Crypto PCB can be separated from the rest, by releasing the four bolts in the corners, after which it can be lifted away from the 34-way connector.
Crypto unit removed from the PCB

Both PCBs have components at either side. The Control PCB hold a microcontroller with internal firmware. The actual Crypto Logic takes the form of a small sub-assembly that is mounted in a socket on the Crypto Board. It has a number of proprietary OEM chips at both sides and is shown in the image above. This module is also used in secure crypto-enabled Cougar radios, such as the ruggedised PRM-4515 handheld radio and the PRM-4735 covert radio.

Rear panel removed Top PCB (crypto board) Bottom PCB (control board) Disassembled unit Crypto board (top) Crypto board (bottom) Control board (top) Control board (bottom)
Crypto board removed Rear view of the front panel Microprocessor and empty EPROM socket Close-up of the backup battery Crypto unit in a socket on the crypto board Modifications in the earlier versions Crypto logic unit (top) Crypto logic unit (bottom)

Power source
The MA-4777 is powered from the system to which it is connected and accepts a DC input between 8V and 22V DC (into either of its sockets). As the power lines of the two connectors are internally connected, the power then becomes available on the other connector (as an output).

When the MA-4083 fill gun is used to load the key variables, the MA-4777 will supply power to it. In the same vain, the MA-4549 optical fill interface will also be powered by the MA-4777.

When the MA-4777 is disconnected from its power source it will retain the key variables (stored in its internal memory) for a period depending on the crypto module that is fitted. With the typical Racal MA-4437 module, the keys will be retained for at least 3 years. When the Special Crypto Module is fitted it will be > 2 hours (typically approx. 5 days).

Crypto modules
For secure communication, the MA-4777 was fitted with a voice encryption/decryption module (or Crypto Module, or Crypto Unit), that was installed on the Crypto Board. Various types of crypto modules were available for different customers and different needs. Note that each type requires a different version of the MA-4073 Programmer and/or the MA-4083 fill gun.

The standard crypto module that was delivered to most customers, is the MA-4437 shown in the image on the right. It uses a Racal-proprietary cryptographic algorithm and can hold up to four cryptographic keys, each of which consists of 120 bits. The key is constructed in the MA-4073 Programmer from 36 octal digits (0-7, or 3 bits) plus a 12-bit fixed prefix (all '1's by default).

The crypto module can encrypt or decrypt the radio's digital 16 kb/s CVSD modulated data stream, but not both at the same time. That means that it can only be used in simplex mode.
MA-4437 top side

The keys are stored inside a Harris MH-6504-9 4096-bit CMOS memory, that is located at the upper side of the module. When using this module, the keys are retained by a built-in battery for more than 3 years, even when the radio is disconnected from the power [A]. This is known as long crypto retention. The presence of a crypto module causes a 128 ms delay in the audio path, which is needed for crypto processing. At the start of a transmission is a 96 ms preamble.

This is a different module that was supplied to some European customers. It is not compatible with the MA-4437 and requires a different version of the programmer and the fill gun ('G' instead of 'C'-version). Nevertheless, the key length seems to be identical (120 bits) [3].

MA-4487 boards are generally red, whilst MA-4437 boards are green. Although it is possible that this board contains the SAVILLE encryption algorithm, but it is more likely that it is 'just' a variation of the standard MA-4437 module. Like the MA-4437 is sends a 96 ms preamble.
MA-4487 top side

The layout of the MA-4487 board is identical to that of the MA-4437 and the 4 chips are also similar, except for the fact that the product code of the two large chips (one at the top and one at the bottom) have a C-suffix (MT70083C versus MT70083, and MT70084C versus MT70084). Like the MA-4437, this board can hold up to 4 crypto keys, all of which are available to the user.

VINSON   Special module
For selected US-approved customers, a so-called Special Module was available that contained the secret SAVILLE encryption algorithm developed by GCHQ and the NSA. This offered compatibility with VINSON equipment like the American KY-57 and the British BID/250 Lamberton voice ciphers.

As SAVILLE uses a 128-bit key (120 key bits plus an 8-bit checksum), the standard MA-4073 and MA-4083 key fillers can not be used. Instead, the keys were transferred by means of a DS-102 fill gun, such as the KYK-13, in combination with the special Racal MA-4778 key fill interface.
MA-4437 top side

When using this module, only two crypto keys can be stored in the device. Furthermore, the crypto keys are only retained for a minimum of 15 minutes (typically several hours) when the device is disconnected from its power source. This principle is known as short crypto retention.

Help required - So far we have never seen the VINSON compatible module, although it is mentioned in official sales information [2] and the required key loaders have been found. If you have any additional information about this mysterious module, please contact us.

No crypto
If the crypto board of the MA-4777 has been removed, four wire loops have to be inserted in the socket the normally contains the crypto module. These wire loops ensure that the 16 kb/s CVSD data is properly bypassed.

The drawing on the right shows the position of the four wire links, as seen from the top. Note the position of the notch, which is close to the edge of the PCB.

Crypto retention
When the power suppy of the MA-4777 is disconnected, the crypto keys are retained for at least 15 minutes (typically several hours), to ensure that the batteries can be swapped without loosing the keys. Normally, a large capacitor (known as a 'SuperCap') on the control board ensures that sufficient power is supplied to the crypto module during this period. In Racal terminology, this is known as short crypto retention. It was typically used in combination with the VINSON module.

Depending on the requirements of the customer, a Lithium battery could be installed in place of the SuperCap, to ensure that the keys were retained indefinitely (typically more than 3 years) when the main battery was disconnected. This is known as long crypto retention. Although it was typically used with the MA-4437, any combination of retention/crypto module was possible.

MA-4437 top side MA-4437 bottom side MA-4437 top side MA-4437 bottom side MA-4487 top side MA-4487 bottom side MA-4487 top side MA-4487 bottom side
Compatible equipment
All crypto modules have the same footprint and can be installed in any PRM-4735. They are also used in other Racal crypto-capable products, such as the PRM-4515 and the MA-4777. A full list of compatible products is given below. Note that devices are only inter­operable if they use the same crypto algorithm, the same frequencies and the same keys. Please note that the devices marked with a * do not use a Racal crypto module, but a proprietary VINSON compatible module, that is interoperable with a Racal device that has the mysterious VINSON module installed.

Racal PRM-4515 Cougar handheld radio with voice encryption Racal PRM-4735 Cougar covert radio with voice encryption Thales PRM-5120 Cougar covert radio with voice encryption KY-57 VINSON voice encryptor (USA) KY-99 voice and data encryptor (USA) in VINSON mode UK Lamberton (BID/250)
*) Only if the PRM-4735 is fitted with a VINSON-compatible crypto module.

 Other Cougar equipment

The three version of the MA-4777 each have a different audio connector at the front panel. The radio socket at the rear is the same for all three variants, although the impendance may be different. The pinout of the sockets for each model are given below.

This version is intended for Clansman compatible equipment. It can be recognised by the 7-pin Clansman-style 105 female audio socket at the front panel. Furthermore the circuit inside the MA-4777 is customised to cope with the Clansman signal levels. The audio socket (marked H for Headset), at the front panel of the MA-4777/A is wired as follows:

  1. Mic in or Fixed Level Audio (FLA) or program input
  2. Mic return or Wideband programming
  3. Power out
  4. Audio out
  5. Ground
  6. PTT or 4 kb/s data or key fill data
  7. Squelch or CTS output
The Radio socket (marked R) at the rear end of the MA-4777 is identical for all three versions (A, B and C) and is wired for Clansman equipment. Any transition to other equipment is made in the cable from the MA-4777 to the radio. For Clansman equipment a straight through (1:1) cable is used between the MA-4777 and the radio. The radio socket R at the rear is wired as follows:

  1. Audio to transmitter (clear speech or 16 kb/s data)
  2. Wideband select
  3. Power input
  4. Audio from receiver
  5. Ground
  6. PTT or 4 kb/s data
  7. Squelch or CTS output
The MA-4777/B is adapted for use in combination with legacy Larkspur equipment. It can be recognised by the 7-pin Larkspur-style 105 female audio socket at the front panel. Although this socket is nearly identical to the Clansman one, it has different index notches at its rim. Note that the internals of the MA-4777/B are customised to cope with the Larkspur signal levels. On this version, the audio socket at the front panel is wired as follows:

  1. Mic in or Fixed Level Audio (FLA) program input
  2. Power out
  3. PTT or 4 kb/s data or key fill data
  4. Ground
  5. Audio out
The C-version of the MA-4777 is made especially for equipment that has an American style 5 or 6 pin audio socket, often referred to as U-229. Again, the internals have been customised to cope with the commonly used audio levels. The wiring of the 5 or 6-pin U-229 socket (U-283/U) at the front panel of the MA-4777/C is as follows:

  1. Ground
  2. Audio out
  3. PTT or 4 kb/s data or key fill data
  4. Mic in or Fixed Level Audio (FLA) program input
  5. Power out
    U-283/U or GC-729 panel mount socket. Click for more information about U-229
  1. Racal, Digital Encryption Unit MA 4777/A/B/C, Technical Manual
    TH 9139, issue 1. February 1988.
  1. Jane's Military Communications, MA-4777 Digital Speech Encryption Unit
    Fifteenth Edition 1994-1995. p. 547.

  2. Jane's Military Communications, AN/CSZ-6 Vinson-compatible Hand-held Transceiver
    Fifteenth Edition 1994-1995. p. 551.
Further information
Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Last changed: Sunday, 07 June 2015 - 11:21 CET.
Click for homepage